Skip to main content
POST
Set an MCP server API key

Authorizations

Authorization
string
header
required

Personal Access Token. Send as Authorization: Bearer hq_pat_....

Path Parameters

slug
string
required

MCP server slug

Body

application/json
api_key
string
required

The bearer token the agent will use against the MCP backend. Caller is responsible for choosing the right scoping (e.g. Stripe restricted key rk_test_..., GitHub PAT, etc.). The platform doesn't validate the token shape - only its presence.

scope
string | null

"team" (default) - credential is shared across the workspace and used for every caller. "user" - credential is private to the caller; the resolver only uses it when this user is the one making the call (otherwise falls through to the team row if any). Server validates against mcp_servers.allowed_scopes and rejects scopes the operator hasn't permitted for this MCP.

Response

The server, installed with a sealed API key

credential_ref
string<uuid>
required
enabled
boolean
required
scope
string
required

Echoed team / user so the caller can confirm the platform honoured their choice rather than silently defaulting.

slug
string
required